I jifl-rr 


UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE 


' * ’ X. . 

Emerging Intelligence Report 


(U) PREPARED BY FBI WASHINGTON FIELD OFFICE 


9 MARCH 2020 
FBI EIR154 20200309 


(U//LES) Darknet Market Actors Likely Convert Illicit Bitcoin to Monero Using 
MorphToken Cryptocurrency Exchange, Impeding Law Enforcement Tracing Efforts 

(U) This document is classified: Unclassified//Law Enforcement Sensitive. 

(U) EIR template approved for fiscal year 2020, as of 1 October 2019. 

(U) LAW ENFORCEMENT SENSITIVE: The information marked (U//LES) in this document is the property of the Federal Bureau of Investigation and may 
be distributed within the federal government (and its contractors), U.S. intelligence, law enforcement, public safety or protection officials, and individuals with 
a need to know. Distribution beyond these entities without FBI authorization is prohibited. Precautions should be taken to ensure this information is stored 
and/or destroyed in a manner that precludes unauthorized access. Information bearing the LES caveat may not be used in legal proceedings without first 
receiving authorization from the originating agency. Recipients are prohibited from subsequently posting the information marked LES on a website on an 
unclassified network without first obtaining FBI approval. 


(U//LES) The FBI assesses Darknet Market (DNM) 
actors likely a convert illicitly obtained Bitcoin into 
anonymity-enhanced cryptocurrency (AEC) b Monero 
using the MorphToken c cryptocurrency exchange, 
impeding law enforcement’s ability to trace the 
destination of the proceeds. This assessment is made 
with high confidence/ based on FBI investigations, 
blockchain analysis, * * * * * 6 use of proprietary software, 
information from MorphToken, and information 
obtained from Darknet sites and forums that cater to 
DNM actors. The FBI assumes the DNM actors’ 
intent of converting cryptocurrencies is not to 
diversify their cryptocurrency portfolio. If this 
assumption is incorrect, it could mean DNM actors 
are not adopting AECs for operational security 
purposes and the FBI’s confidence in the assessment 
would decrease. The FBI bases this assessment on 
reporting of DNM actors converting Bitcoin to 
Monero, the availability of information on the 
inability to trace Monero, and the means of acquiring 
it without providing user information. 

• (U//FOUO) As of January 2020, DNM 

actors associated with Apollon DNM sent at 
least 11 bitcoin (worth approximately 
$80,000) to MorphToken to convert to 
Monero between December 2019 and 
January 2020, according to a proprietary 
software tool that analyzes financial 


transactions of the Bitcoin blockchain and 
use of MorphToken’s automated 
programming interface (API). 1 

• (U//FOUO) As of October 2019, FBI 
analysis revealed commission fees from 
Bitcoin transactions conducted on Cryptonia 
DNM between May and September 2019 
were sent to addresses associated with 
MorphToken, based on an FBI investigation 
and blockchain analysis. All Bitcoin 
transactions able to be queried using 
MorphToken’s API were converted to 
Monero. 2,3 ’ 4 

• (U//FES) As of November 2019, the FBI 
identified at least four DNM vendors that 
sent Bitcoin drug sale proceeds to 
MorphToken, based on FBI investigations, 
open source blockchain tracing, and use of a 
proprietary software tool that analyzes 
financial transactions of the Bitcoin 
blockchain. 5,6 ’ 7? 8 

• (U) As of January 2020, sites and forums 
that cater to DNM actors provided guides to 
obtain and use Monero. 9,10 Many user posts 
on the topic discussed the use of 


a (U) See Appendix A: Expressions of Likelihood. 

b (U//FOUO) Analyst Note: AECs, unlike Bitcoin, do not publish fully public records of all transactions. This prevents law 

enforcement from exploiting those records to follow the flow of value through blockchain analysis, a key tool in de¬ 
anonymizing DNM actors. 

c (U) MorphToken is a fee-based cryptocurrency exchange service. Customers select which cryptocurrency to send and receive 

from MorphToken. MorphToken operates without user accounts and does not collect user information. 
d (U) See Appendix B: Confidence in Assessments and Judgments Based on a Body of Information. 

6 (U) Analyst Note: A blockchain is a digital public ledger that records online cryptocurrency transactions, including those in 
Bitcoin. Open source tools enable the analysis of these transactions to identify movement of funds. 


UNCLASSIFIED// LAW ENFORCEMENT SENSITIVE 



FY 2020 EIR 1 OCT 2019 


UNCLASSIFIED// LAW ENFORCEMENT SENSITIVE 


MorphToken and similar services, which do 
not collect user information to convert 
Bitcoin to Monero to safely make DNM 
purchases or to “clean” “dirty btc.” 11,12,13,14 
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(U) Analysis of Alternatives 

(U//LES) The FBI considered the alternative hypothesis 
that DNM actors likely only use MorphToken to diversify 
their cryptocurrency portfolios. The FBI discounted this 
alternative because many cryptocurrency wallets do not 
support transactions using Monero and many exchanges 
do not accept Monero—limitations that would deter 
investors. Additionally, although MorphToken offers to 
convert Bitcoin into five different cryptocurrencies, in 
nearly all the conversions the FBI identified conducted by 
DNM actors—where the output currency could be 
identified—the user converted Bitcoin into Monero. 

(U//LES) This emerging intelligence report’s 
assessment is consistent with previous assessments 
made by the FBI, including the 30 November 2018 
FBI Intelligence Assessment, titled (U//LES) 
Emerging Darknet Technologies Will Almost 
Certainly Strengthen the Security of Illicit Traders, 
Mitigating the Effectiveness of Proven Investigative 
Techniques , which assessed AECs, such as Monero, 
would gain usage by individuals exploiting the 
Darknet for illicit trade. The analysis in this emerging 
intelligence report aligns with and substantiates that 
intelligence assessment by providing examples of 
DNM actors converting Bitcoin into AECs to conceal 
criminal proceeds. The FBI assesses, as examples of 
law enforcement successfully tracing cryptocurrency 
are published and the accessibility of AECs improves, 
criminals likely will increase adoption of AECs and 
the use of services like MorphToken, which do not 
collect “Know Your Customer” (KYC) information, 


to obtain them in the near term. More widespread 
criminal adoption of AECs will severely limit the 
ability of law enforcement to trace cryptocurrency 
involved in illicit activities with existing investigative 
techniques. Broader acceptance of AECs for 
payments on DNMs, increased availability of non- 
KYC cryptocurrency exchangers like MorphToken, 
and blockchain analysis indicating an increased 
volume of transactions conducted by these services 
would strengthen this assessment. 
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(U) Source Summary Statement 

(U//FOUO) Reporting in this emerging intelligence 
report was derived primarily from FBI investigations 
and blockchain analysis with direct access, a 
proprietary software tool that analyzes financial 
transactions of the Bitcoin blockchain, and open source 
information obtained from forums that cater to Darknet 
audiences and through use of MorphToken’s publically 
available API. The FBI investigations and blockchain 
analysis were critical to the key judgment that illicit 
proceeds were being converted to AECs, as it identified 
the movement of Cryptonia sales commissions, vendor 
payments, and likely Apollon sales commissions to the 
cryptocurrency exchanger MorphToken. The open 
source information provided context to the FBI’s 
analysis and helped to inform its outlook. This 
information collection occurred between August 2018 
and January 2020, and was current as of 30 January 
2020. 


(U) If you would like to provide qualitative feedback on this 
product, please send an email to the appropriate address with the 
product title as the subject line: DI_Customer_Feedback@fbi.gov; 
DI_Customer_Feedback@fbi.sgov.gov; or 
DI_Customer_Feedback@ fbi.ic.gov. 

(U) FBI Washington Field Office prepared this emerging intelligence 
report. Please direct comments and queries to the FBI Washington Field 
Office Field Intelligence Group at 1-202-278-2000. 
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(U) Appendix A: Expressions of Likelihood 


(U) Phrases such as “the FBI judges” and “the FBI assesses,” and terms such as “likely” and “probably” convey 
analytical judgments and assessments. The chart below approximates how expressions of likelihood and 
probability correlate with percentages of chance. Only terms of likelihood should appear in FBI products; the chart 
includes terms of probability strictly for comparison, as they sometimes appear in reporting of other government 
agencies. Furthermore, the FBI does not arrive at judgments through statistical analysis and will not use terms of 
probability to convey uncertainty in FBI external intelligence products. 
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Terms of 
Likelihood 


Terms of 
Probability 


Percentages 
of Chance 


Almost 

No 

Chance 

Very 

Unlikely 

Unlikely 

Roughly 

Even 

Chance 

Likely 

Very 

Likely 

Almost 

Certain(ly) 

Remote 

Highly 

Improbable 

Improbable 

(Improbably) 

Roughly 

Even 

Odds 

Probable 

(Probably) 

Highly 

Probable 

Nearly 

Certain 

1-5% 

5-20% 

20-45% 

45-55% 

55-80% 

80-95% 

95-99% 


(U) Table showing terms of likelihood aligned with terms of probability and percentages of chance. 
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(U) Appendix B: Confidence in Assessments and Judgments Based on 
a Body of Information 

(U) Confidence levels reflect the quality and quantity of the source information supporting a judgment. 
Consequently, the FBI ascribes high, medium, or low levels of confidence to assessments, as follows: 

(U) High confidence generally indicates the FBI’s judgments are based on high quality information from multiple 
sources. High confidence in a judgment does not imply the assessment is a fact or a certainty; such judgments 
might be wrong. While additional reporting and information sources may change analytical judgments, such 
changes are most likely to be refinements and not substantial in nature. 

(U) Medium confidence generally means the information is credibly sourced and plausible but not of sufficient 
quality or corroborated sufficiently to warrant a higher level of confidence. Additional reporting or information 
sources have the potential to increase the FBI’s confidence levels or substantively change analytical judgments. 

(U) Low confidence generally means the information’s credibility or plausibility is uncertain, the information is 
too fragmented or poorly corroborated to make solid analytic inferences, or the reliability of the sources is 
questionable. Absent additional reporting or information sources, analytical judgments should be considered 
preliminary in nature. 
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